Fortinet Exam FCP_FAZ_AN-7.4 Topic 2 Question 9 Discussion

Actual exam question for Fortinet's FCP_FAZ_AN-7.4 exam

Question #: 9
Topic #: 2

What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?

AFortiAnalyzer flags the associated host for further analysis.

BA new infected entry is added for the corresponding endpoint under Compromised Hosts.

CThe detection engine classifies those logs as Suspicious.

DThe endpoint is marked as Compromised and, optionally, can be put in quarantine.

Show Suggested Answer

Suggested Answer: B

by Harrison at Feb 06, 2025, 08:59 PM

Limited Time Offer

25%

Off

Get Premium FCP_FAZ_AN-7.4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Antonio

2 months ago

Option D is the way to go. Quarantining the compromised endpoint is the best way to prevent further damage. Hopefully, the user has a good warranty on their device.

upvoted 0 times

...

Hillary

2 months ago

C is my pick. Classifying the logs as suspicious is a good first step, but I'd expect more actions to be taken as well.

upvoted 0 times

...

Gladis

2 months ago

Haha, I bet the correct answer is actually that the FortiAnalyzer orders a pizza for the suspicious user. Gotta keep those hackers fed, right?

upvoted 0 times

Alverta

27 days ago

D) The endpoint is marked as Compromised and, optionally, can be put in quarantine.

upvoted 0 times

...

Gracia

1 months ago

C) The detection engine classifies those logs as Suspicious.

upvoted 0 times

...

Talia

1 months ago

B) A new infected entry is added for the corresponding endpoint under Compromised Hosts.

upvoted 0 times

...

Mila

1 months ago

A) FortiAnalyzer flags the associated host for further analysis.

upvoted 0 times

...

Pamela

2 months ago

I believe the answer is D) The endpoint is marked as Compromised and can be put in quarantine, to prevent further damage.

upvoted 0 times

...

Cheryl

2 months ago

I agree with Dean, because it makes sense to investigate further when a blacklisted IP address is detected.

upvoted 0 times

...

Gail

2 months ago

I'm going with B. Adding a new infected entry under Compromised Hosts helps keep track of the issue and take appropriate action.

upvoted 0 times

...

Stephanie

2 months ago

Option D seems like the most comprehensive response. Marking the endpoint as compromised and the ability to quarantine it is a crucial security measure.

upvoted 0 times